下一朵云 - DATACOM / LINUX / DB / SECURITY

Docker Build 编译补丁版 PHP7.4 FPM 容器镜像教程（CVE-2026-109618 / CVE-2026-109619）

安全2026-10-22

用途：编译独立 PHP7.4-FPM 镜像，用于配合 Apache/Nginx 容器以 FCGI 方式解析 PHP，适配无法兼容最新版本PHP的服务
⚠️ PHP7.4 官方已经停止维护，仅内网兼容老程序场景使用，不建议直接对公网暴露

01-primary-blue-docker-logo

目录结构

php74-build/
├─ Dockerfile
├─ php.ini
├─ php-fpm.conf
└─ www.conf

1、Dockerfile

FROM debian:bookworm AS builder
ENV DEBIAN_FRONTEND=noninteractive

RUN echo "deb http://mirrors.ustc.edu.cn/debian bookworm main non-free-firmware" > /etc/apt/sources.list && \
    echo "deb http://mirrors.ustc.edu.cn/debian bookworm-updates main non-free-firmware" >> /etc/apt/sources.list && \
    echo "deb http://mirrors.ustc.edu.cn/debian-security bookworm-security main non-free-firmware" >> /etc/apt/sources.list && \
    rm -f /etc/apt/sources.list.d/debian.sources

RUN apt-get update && apt-get install -y --no-install-recommends \
    gcc g++ make autoconf automake libtool flex bison re2c pkg-config git wget curl unzip ca-certificates \
    libxml2-dev libbz2-dev libcurl4-openssl-dev libjpeg-dev \
    libpng-dev libfreetype6-dev libzip-dev libonig-dev libreadline-dev \
    libxslt1-dev sqlite3 libsqlite3-dev libgettextpo-dev \
    && rm -rf /var/lib/apt/lists/*

# ========== 编译 OpenSSL 1.1.1w ==========
WORKDIR /usr/src
RUN wget --no-check-certificate https://mirrors.orcy.net.cn:10101/fedora/26/php74-repo/openssl-1.1.1w.tar.gz \
    && tar zxf openssl-1.1.1w.tar.gz
WORKDIR /usr/src/openssl-1.1.1w
RUN ./config --prefix=/opt/openssl-1.1.1 --openssldir=/opt/openssl-1.1.1/ssl shared zlib -fPIC \
    && make -j$(nproc) \
    && make install

# ========== 编译 PHP7.4 链接 /opt/openssl-1.1.1 ==========
WORKDIR /usr/src
RUN wget --no-check-certificate https://mirrors.orcy.net.cn:10101/fedora/26/php74-repo/php-src-PHP-7.4-CVE-2026-109618-109619.zip \
    && unzip php-src-PHP-7.4-CVE-2026-109618-109619.zip \
    && mv php-src-PHP-7.4-CVE-2026-109618-109619 php-src \
    && rm -f php-src-PHP-7.4-CVE-2026-109618-109619.zip

WORKDIR /usr/src/php-src
RUN ./buildconf --force

# 关键：PKG_CONFIG_PATH 指定我们自己编译的 openssl1.1
ENV PKG_CONFIG_PATH="/opt/openssl-1.1.1/lib/pkgconfig"
RUN ./configure \
    --prefix=/usr/local/php74 \
    --with-config-file-path=/usr/local/php74/etc \
    --enable-fpm \
    --enable-cli \
    --enable-mbstring \
    --enable-bcmath \
    --enable-sockets \
    --enable-pcntl \
    --enable-opcache \
    --enable-ftp \
    --enable-exif \
    --enable-calendar \
    --enable-shmop \
    --enable-sysvmsg \
    --enable-sysvsem \
    --enable-sysvshm \
    --enable-ctype \
    --enable-fileinfo \
    --enable-filter \
    --enable-gd \
    --with-jpeg \
    --with-freetype \
    --with-openssl \
    --with-curl \
    --with-zip \
    --with-bz2 \
    --with-readline \
    --with-mysqli=mysqlnd \
    --with-pdo-mysql=mysqlnd \
    --with-pdo-sqlite \
    --with-sqlite3 \
    --with-gettext \
    --with-xsl \
    --with-zlib

RUN make -j$(nproc) && make install

# ========== 编译 apcu ==========
WORKDIR /usr/src
RUN wget --no-check-certificate https://mirrors.orcy.net.cn:10101/fedora/26/php74-repo/apcu-5.1.22.tgz \
    && tar zxf apcu-5.1.22.tgz \
    && cd apcu-5.1.22 \
    && /usr/local/php74/bin/phpize \
    && ./configure --with-php-config=/usr/local/php74/bin/php-config \
    && make -j$(nproc) && make install

# ===================== 运行镜像 =====================
FROM debian:bookworm
ENV DEBIAN_FRONTEND=noninteractive

RUN echo "deb http://mirrors.ustc.edu.cn/debian bookworm main non-free-firmware" > /etc/apt/sources.list && \
    echo "deb http://mirrors.ustc.edu.cn/debian bookworm-updates main non-free-firmware" >> /etc/apt/sources.list && \
    echo "deb http://mirrors.ustc.edu.cn/debian-security bookworm-security main non-free-firmware" >> /etc/apt/sources.list && \
    rm -f /etc/apt/sources.list.d/debian.sources

RUN apt-get update && apt-get install -y --no-install-recommends \
    libxml2 libbz2-1.0 libcurl4 libjpeg62-turbo libpng16-16 \
    libfreetype6 libzip4 libonig5 libreadline8 libxslt1.1 sqlite3 libgettextpo0 \
    && rm -rf /var/lib/apt/lists/*

# 复制自编译的 openssl1.1 + php
COPY --from=builder /opt/openssl-1.1.1 /opt/openssl-1.1.1
COPY --from=builder /usr/local/php74 /usr/local/php74

# 运行时链接库路径
ENV LD_LIBRARY_PATH="/opt/openssl-1.1.1/lib:$LD_LIBRARY_PATH"
ENV PATH="/usr/local/php74/bin:/usr/local/php74/sbin:${PATH}"

RUN mkdir -p /var/www/html /usr/local/php74/etc/php-fpm.d

COPY php.ini /usr/local/php74/etc/
COPY php-fpm.conf /usr/local/php74/etc/
COPY www.conf /usr/local/php74/etc/php-fpm.d/

EXPOSE 9000
CMD ["php-fpm", "-F"]

提示：【替换为你的补丁php7.4源码包地址】 改成你存放打好CVE补丁的PHP7.4源码压缩包链接

2、配套配置文件

php-fpm.conf

pid = run/php-fpm.pid
error_log = /dev/stderr
log_level = notice
daemonize = no
include = etc/php-fpm.d/*.conf

www.conf

[www]
listen = 0.0.0.0:9000
listen.allowed_clients = 127.0.0.1,172.17.0.0/16,172.18.0.0/16

user = www-data
group = www-data

pm = dynamic
pm.max_children = 30
pm.start_servers = 8
pm.min_spare_servers = 4
pm.max_spare_servers = 12

pm.status_path = /fpm-status
request_terminate_timeout = 120s

php.ini

date.timezone = Asia/Shanghai
memory_limit = 256M
upload_max_filesize = 64M
post_max_size = 64M
max_execution_time = 120
max_input_vars = 3000
opcache.enable = 1
opcache.enable_cli = 1
opcache.memory_consumption = 128
opcache.max_accelerated_files = 10000
opcache.revalidate_freq = 60
extension=apcu
apc.enable_cli=1

3、构建镜像命令

进入 php74-build 目录执行：

docker build -t php74-patched-fpm:7.4.34 .

4、本地启动测试镜像

docker run -d \
  --name php74-fpm \
  -v /home/www/html:/var/www/html \
  php74-patched-fpm:7.4.34

如需跨容器通信，把容器加入自定义docker网络：
docker network create php74-net
docker network connect php74-net php74-fpm

5、验证构建结果

# 查看PHP版本
docker exec -it php74-fpm php -v
# 查看已加载扩展
docker exec -it php74-fpm php -m
# 确认fpm监听端口
docker exec -it php74-fpm ss -tlnp

6、注意事项

编译阶段对CPU要求较高，低配机器构建耗时久；
补丁版PHP源码需要你自行准备并提供下载地址；
前端apache容器和php-fpm容器挂载同一个站点目录，文件路径保持一致；
跨容器通信优先使用自定义bridge网络，支持容器名DNS解析；
仅内网兼容老项目使用，PHP7.4无官方安全维护。